Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
16-03-2024 13:08
General
-
Target
ce23368581820c067143e66da21518d4.exe
-
Size
2.9MB
-
MD5
ce23368581820c067143e66da21518d4
-
SHA1
0e45012546c87cdc6b77b4510352b473ea391a29
-
SHA256
36c002b316a5b3b0d90f7ceeb8ae59df602183c81613accebbf2272148c0f5d2
-
SHA512
9b4894b2c56f4c01579fa24a7c0683a5c49b9137784d446c2b3a5f3f30fd8a00dffa6f3731e6177b5df0621f3c0a91bfd4ccc69063b6ea2ff0fa250b5dcd75e6
-
SSDEEP
49152:sHlp88MMS1qQFbHINgSTZw0N74NH5HUyNRcUsCVOzetdZJ:ep8iS1qQFE/TZw04HBUCczzM3
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce23368581820c067143e66da21518d4.exe"C:\Users\Admin\AppData\Local\Temp\ce23368581820c067143e66da21518d4.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ce23368581820c067143e66da21518d4.exeC:\Users\Admin\AppData\Local\Temp\ce23368581820c067143e66da21518d4.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD554ce203f52f12a2090c18ab643720b79
SHA11ec9a2e5dfb67487038d15ac8162942cb4aa0d60
SHA2569bf33adca646d502fd9b456323a6cb6e9d8ab41b9650dabc4c25a935c8115403
SHA51248aefbbd94c0c967adf26f343899e0464ca81eaec9e85bc2dd5cf08a26cacd48f8601d365914f9741c1c7a3b5ee5e29c3597f48ebd4c8140a5ef4bef37e201ec
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB